Virtual Private Network Service Research Articles

A New Traffic Distribution Routing Algorithm for Low Level VPNs

Virtual Private Networks (VPN) constitute a particular class of shared networks. In such networks, the resources are shared among several customers. The management of these resources requires a high level of automation to obtain the dynamics necessary for the well-functioning of a VPN. In this paper, we consider the problem of a network operator who owns the physical infrastructure and who wishes to deliver VPN service to his customers. These customers may be Internet Service providers, large corporations and enterprises. We propose a new routing approach referred to as Traffic Split Routing (TSR) which splits the traffic as fairly as possible between the network links. We show that TSR outperforms Shortest Path Routing (SPR) in terms of the number of admitted VPN and in terms of Quality of Service.

Design, Structure and Significance of Virtual Machines in Network Management System: An Emulation Analysis of VMware Based Hospital System in Pakistan

The trend of the use of virtual machines is vitally growing in the world. Virtual machines are being used in different organizations. These virtual machines come as a result from an output of a host hypervisor. If an organization or an institution is being run by virtualization then it is possible that unnecessary expenses, additional burden, wastage of resources and excesses of space can be reduced for networking. With the organizations when the structure of a medical institution or hospital is viewed it comes out that even big and small hospitals are shifting their management systems to certain kinds of networks. As it is visible in the rapidly advancing world that hospitals are also using networking technology so why not they shift to virtualization? So, to observe either virtualization can effectively run in a hospital scenario this research is conducted. To further analyze if this can work in the setting of Pakistan or not? This research is conducted according to an assumed situation of Hospital that has four different branches in a country. To find the outcomes simulation method is used. A network is built on VMware Workstation. This network is designed to run a hospital networking system. That comprises of a virtual private network server, firewall router, file transfer protocol server, web server, and voice over internet protocol server, virtual local area network, active directory, virtual switches, dynamic host control protocol et cetera. After proper testing of the VMware then fully loaded system is launched and every functional requirement is utilized to clearly investigate the progress of a virtual network and this research has resulted in a successful network management system for Health Care Hospital in Pakistan. In viewing this the researcher has invented two concepts in this research that are “Hospital Virtualization” and “Pocket Network Theory.”

VPN Traffic Detection in SSL-Protected Channel

In recent times, secure communication protocols over web such as HTTPS (Hypertext Transfer Protocol Secure) are being widely used instead of plain web communication protocols like HTTP (Hypertext Transfer Protocol). HTTPS provides end-to-end encryption between the user and service. Nowadays, organizations use network firewalls and/or intrusion detection and prevention systems (IDPS) to analyze the network traffic to detect and protect against attacks and vulnerabilities. Depending on the size of organization, these devices may differ in their capabilities. Simple network intrusion detection system (NIDS) and firewalls generally have no feature to inspect HTTPS or encrypted traffic, so they rely on unencrypted traffic to manage the encrypted payload of the network. Recent and powerful next-generation firewalls have Secure Sockets Layer (SSL) inspection feature which are expensive and may not be suitable for every organizations. A virtual private network (VPN) is a service which hides real traffic by creating SSL-protected channel between the user and server. Every Internet activity is then performed under the established SSL tunnel. The user inside the network with malicious intent or to hide his activity from the network security administration of the organization may use VPN services. Any VPN service may be used by users to bypass the filters or signatures applied on network security devices. These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware.

Design and Deployment of IPSec VPN Using CISCO Network Infrastructure

Online networks have many threats regarding security. The threats are targeting agency networks, private networks or other networks via gaining access to or changing essential information. Less secure networks deliver authorization to the users to access records in a network. Communication managers need powerful police forces to prevent access, misuse or alteration of secure network information. Small businesses or small businesses use firewalls, antibiotics or anti-spam software to protect the network, but do not provide sufficient network protection. Security in the corporate network is an important part of network protection due to the most common hacker goals. A private network is a reliable way of communicating with various business units and communicating with internal networks. Internet Protocol Security (IPsec) Virtual Private Network (VPN) is one of the most powerful security tools in the field of recording and security options. This is the safest and most secure option available in the Private Network store as a combination of two or more networks in remote areas. The goal of this research is to integrate VPN Services and establish IPsec protocols for small business security. The study is based on the networks of National College of business administration & economics (NCBA&E BWP) and its campuses by using the Cisco routers for a secure and private communication interchange between them. The result shows that IPsec VPN is an appropriate way of communication for Small and Medium-Sized Enterprises (SMEs).

A hybrid fog-cloud approach for securing the Internet of Things

As the Internet of Things (IoT) continues to grow, there arises concerns and challenges with regard to the security and privacy of the IoT. Malicious attacks such as man-in-the-middle and distributed denial of service (DDoS) are typical threats to the IoT systems. In this paper, we propose a FOg CompUting-based Security (FOCUS) system to provide security for IoT systems against those malicious attacks. The proposed FOCUS system applies a threefold protection mechanism: Firstly, it makes use of the virtual private network (VPN) to secure the communication channels for the IoT devices; Secondly, it applies machine learning-based traffic analysis unit to classify the traffic to be trusted, untrusted and suspicious; Thirdly, it adopts a challenge-response authentication to validate the suspicious traffic source so as to protect the VPN server against potential DDoS attacks. Such a threefold protection mechanism is effective in mitigating various malicious attacks and can provide a high standard security for the IoT system. Furthermore, to improve the system performance, FOCUS is implemented in a hybrid fog-cloud model that achieves a low latency and system response time. In the hybrid fog-cloud model, a selected amount of the protection and validation requests are addressed in the fog that is close to the end users, while the excessive requests are addressed in the cloud. Through this, FOCUS can effectively avoid the long queuing delay caused by the limited computational capacity in the fog implementation. The experimental results show that FOCUS can effectively filter out malicious attacks with low response time and small network cost (e.g., network bandwidth consumption).

Implementation and analysis ipsec-vpn on cisco asa firewall using gns3 network simulator

The Internet provides less guarantee of security in the process of information exchange. Virtual Private Network (VPN) IP Security(IPSec) based has been implemented to overcome this issues. This research builds a private network that provides quality and security in accessing the Internet. The entire set of systems were built in a virtual and simulated manner. It is built using GNS3 network simulator software and virtual Cisco ASA Firewall. The result shows that VPN network connectivity is strongly influenced by the hardware used as well as depend on Internet bandwidth provided by Internet Service Provider (ISP). In addition to the security testing result shows that IPSec-based VPN can provide security against Man in the Middle (MitM) attacks. However, the VPN still has weaknesses against network attacks such as Denial of Service (DoS) that causes the VPN server can no longer serve VPN client and become crashes.

UNJUK KERJA PENERAPAN TEKNOLOGI VoIP PADA JARINGAN VPN (VIRTUAL PRIVATE NETWORK)

VoIP ( Voice over Internet Protocol ) is a technology used for communication in the form of IP based voice media over long distances. The concept of a VPN (Virtual Private Network) in this paper makes a client that is on the public network can be connected to a LAN network. To use the VoIP server in the Linux operating system Trixbox, whereas for the VPN server using ClearOS and X-lite is used as a softphone to make calls to the client. Of testing at 64kbps bandwidth using the G711 codec produces value performance (delay, jitter, and packet loss ) is not good, so that voice data delivered is less clear. Thus the choice of bandwidth for the G.711 codec 512kbps up is the best solution to get the value of the performance (delay, jitter, and packet loss) better . And a choice of 3 Greed (low, medium, high) on setting bandwidth, high is the best option. Because it can produce the best performance for VoIP VPN technology.

VPNs in the library

PurposeThe purpose of this study is to examine the use of a virtual private network (VPN) as an additional protective strategy for patrons using library computers.Design/methodology/approachThis study is a literature review and commentary on this topic that has been addressed by professionals, researchers and practitioners.FindingsCredit must be given to those libraries who have made free VPN services available to their patrons, thus encouraging off-site usage of library resources through this extra layer of authentication in an effort to provide them with a trust level of privacy beyond their standard expectations. Should the library not provide such a service at present, at least an individual can add a VPN to one’s protective bag of tricks to, perhaps, in an effort to place even a limited constraint on those who would do them harm when online.Originality/valueThe value in exploring this topic is to provide some context and potential options for patrons through their use of a VPN.

DESIGN OF TRAFFIC ENGINEERED MULTI-PROTOCOL LABEL SWITCHING-TRANSPORT PROFILE (MPLS-TP) FOR THE ENHANCEMENT OF QUALITY OF SERVICE

Multiprotocol Label Switching (MPLS) is a switching technology. MPLS-TP is a progressive version of MPLS in the field of packet switched data network. MPLS-TP is a high-end technology which implements network methodologies in a transport layer. For managing virtual private network(VPN) services, MPLS is of developing enthusiasm to the service providers (SPs) and furthermore to VPN customers. MPLS-enabled routers allot a few labels to the packets, and in view of these allocated labels it produces sending decisions. The prime expectation after the MPLS technology is to eliminate the need of OSI model data link layered
 (layer-2) technology i.e. frame relay, Ethernet, asynchronous transfer mode (ATM). This paper gives data about the components of Multi-Protocol Label Switching (MPLS), correlation of MPLS with traditional Routing and Packet Switching, MPLS label format and MPLS operation.

UMTS rapid response real-time seismic networks: implementation and strategies at INGV

Abstract. Universal Mobile Telecommunications System (UMTS) and its evolutions are nowadays the most affordable and widespread data communication infrastructure available almost world wide. Moreover the always growing cellular phone market is pushing the development of new devices with higher performances and lower power consumption. All these characteristics make UMTS really useful for the implementation of an "easy to deploy" temporary real-time seismic station. Despite these remarkable features, there are many drawbacks that must be properly taken in account to effectively transmit the seismic data: Internet security, signal and service availability, power consumption. – Internet security: exposing seismological data services and seismic stations to the Internet is dangerous, attack prone and can lead to downtimes in the services, so we setup a dedicated Virtual Private Network (VPN) service to protect all the connected devices. – Signal and service availability: while for temporary experiment a carefull planning and an accurate site selection can minimize the problem, this is not always the case with rapid response networks. Moreover, as with any other leased line, the availability of the UMTS service during a seismic crisis is basically unpredictable. Nowadays in Italy during a major national emergency a Committee of the Italian Civil Defense ensures unified management and coordination of emergency activities. Inside it the telecom companies are committed to give support to the crisis management improving the standards in their communication networks. – Power consumption: it is at least of the order of that of the seismic station and, being related to data flow and signal quality is largely unpredictable. While the most secure option consists in adding a second independent solar power supply to the seismic station, this is not always a very convenient solution since it doubles the cost and doubles the equipment on site. We found that an acceptable trade-off is to add an inexpensive Low Voltage Disconnect (LVD) circuit to the UMTS router power supply that switches off the data transmission when the power is low. This greatly reduces the probability of data loss but lowers the real-time data availabilty. This approach guarantees on the average a satisfactory data acquistion rate, only in very few cases and when the real-time data is extremely important for a particular site we needed to double the power supply on the site. Overall the UMTS data transmission has been used in most temporary seismic experiments and in all seismic emergencies happened in Italy since 2010 and has proved to be a very cost effective approach with real-time data acquisition rates usually greater than 97 % and all the benefits that result from the fast integration of the temporary data in the National Network monitoring system and in the EIDA data bank.

Becoming a Cyber Power

On 21 January 2015, Internet users in China who were trying to access blocked websites and smartphone apps encountered difficulties connecting to virtual private networks (VPNs), a popular circumvention tool for bypassing censorship in a country where government control of online space has been notorious. Astrill, StrongVPN and Golden Frog, three major providers of commercial VPN services that reported service disruptions, all blamed the interference on the Chinese cyberspace authorities. The attack, they claimed, was carried out with a level of sophistication unseen before. (1)Having the world's largest online population with more than 600 million Internet users, China has also been known for its highly restrictive Internet control, which forms an integral part of the government's extensive oversight of information flow, ranging from media to culture. A recent Freedom House report detailed the government's sophisticated techniques to impose information control, including strategic control over key information nodes, censorship outsourcing, stronger Party leadership, ideological re-emphasis, and a crackdown on social media.(2)But so far, the Chinese authorities have kept their hands off the use of VPNs, which leaves a small window for China's Internet users - from ordinary surfers to privileged elites - to enjoy an unfettered Internet for entertainment and professional uses. The clampdown on VPNs hence suggests the government's new thinking with respect to circumvention around the censors, or what is known as the Great Firewall (fanghuoqiang ???). What explains the change? And why such timing? State media later said that the VPN block was due to an upgrade of the Great Firewall,(3)and senior state officials, for the first time, even acknowledged responsibility. According to Wen Ku, director of telecom development at the Ministry of Industry and Information Technology (MIIT), the VPN block was intended to ensure the healthy and lawful development of the Internet. (4) Although VPN providers managed to recover their services by reconfiguring their settings to outwit the Great Firewall, it appeared that Chinese cyberspace authorities are serious and open about clamping down on circumvention tools, and that they are refining their technology to shut off China's Internet and turn it into an Intranet if necessary. The block also appeared as the latest episode in a series of cyber-policing measures over the past few months, including the blocking of Google and Gmail and deliberate attacks on foreign sites such as Microsoft, Yahoo, and Apple. While these measures reflect the continuation of China's long-standing policy to increase oversight on the Internet, they further suggest that the authorities are taking steps to control segments in cyberspace that cannot be readily monitored - channels that were once allowed to leave an open door for Internet users to access information from foreign sources.This article begins by discussing possible reasons behind the VPN block and linking it to the institutional expansion of the cyberspace authorities, which has resulted in a series of measures to tighten up cybersecurity. It argues that these measures reflect two main strategies: content control and technological self-sufficiency. These two strategies are key building blocks in China's conception of cybersecurity, a notion defined by Chinese officials as technologies and processes designed to protect against Internet-based threats to a wide range of domains, including political and ideological integrity, data, technology, applications, businesses, and communication channels.(5)These strategies are not only aimed at maintaining regime survival and protecting national security, but are also intended to nurture the domestic economy - particularly the technology industry. The increasingly restrictive Internet policies suggest that China is keen to pursue cybersecurity as a national priority, and is doing so regardless of the serious consequences it might entail. …

A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients

Abstract Commercial Virtual Private Network (VPN) services have become a popular and convenient technology for users seeking privacy and anonymity. They have been applied to a wide range of use cases, with commercial providers often making bold claims regarding their ability to fulfil each of these needs, e.g., censorship circumvention, anonymity and protection from monitoring and tracking. However, as of yet, the claims made by these providers have not received a sufficiently detailed scrutiny. This paper thus investigates the claims of privacy and anonymity in commercial VPN services. We analyse 14 of the most popular ones, inspecting their internals and their infrastructures. Despite being a known issue, our experimental study reveals that the majority of VPN services suffer from IPv6 traffic leakage. The work is extended by developing more sophisticated DNS hijacking attacks that allow all traffic to be transparently captured.We conclude discussing a range of best practices and countermeasures that can address these vulnerabilities

Understanding the use of circumvention tools to bypass online censorship

Circumvention tools designed to bypass online censorship—such as simple web proxies, virtual private network service, and so on—are frequently used in countries whose governments impose heavy Internet censorship. Around 18 million Internet users in China are currently using those tools to bypass the Great Firewall and access unblocked online content. In a pioneering empirical investigation of unblocked information seeking in China’s censored online environment, the present study systematically examines a wide range of macro-social and micro-individual factors which affect the use of circumvention tools to bypass Internet censorship under the guidance of the interactive communication technology adoption model. The results reveal that, with the exception of social trust, macro-social factors have only a modest influence on the use of circumvention tools. In contrast, micro-individual-level variables—including perceived technology fluidity, gratifications, and selected demographic variables—play a much larger role in our multivariate model. Theoretical and practical implications are discussed.

Improved Elliptic Encryption Algorithm

While the rapid development of Internet technology and communication technology, SSL VPN (security socket Layer Virtual Private Network) as a new remote access technology about network application layer, not only based on the proven SSL protocol, but meet the needs of most of network users. In recent years, enterprise networks have been widely used. However, due to its structure so that all access and calculation must be processed through VPN service, which appeared insufficient memory, computing speed to keep up with other issues. This article proposed some improvement based on these issues, using the improved algorithm to encrypt the ellipse. Keywords-SSL;VPN;Ellipsealgorithm

Securing virtual private LAN service by efficient key management

Virtual private local area network service VPLS is a layer 2 service provider-provisioned virtual private network service. Security is one of the key system requirements of a VPLS because it delivers the frames via an untrusted network. Several VPLS architectures are proposed during the recent years. However, many of them do not provide a sufficient level of security. On the other hand, the existing secure VPLS architectures are also suffering from the scalability issues, and they are infeasible to implement in large scale networks.

Performance Analysis of Rejection Ratio in Cost Optimized Virtual Private Networks Provisioning Algorithm (COVPA) Using Waxman and Barabasi Model in Cyber Space

Problem statement: Virtual private networks have provided customers with a secure and low-cost communication environment. Approach: The COVPA, the provisioning algorithm for a Virtual Private Network service, which built and managed VPNs on demand. Results: The COVPA allowed each VPN to have guaranteed resources and customized control and supported a highly dynamic VPN service where creation and modification operations took place on fast timescales at reduced cost. Also, it allowed the sharing of bandwidth on the links to reduce the cost. A design process is described, that attempts to satisfy the goals of both the customer and the VPN Service Provider (VSP). Conclusion/Recommendations: The performance of the proposed algorithm is analyzed in terms of cost, the number of nodes, the number of VPN nodes, asymmetric ratio and rejection ratio with the breadth first search, steiner tree and primal dual algorithms. With the enhancement on the design process, the COVPA performs better than the breadth first search, steiner tree and primal dual algorithms

A New Approach To Enhance Security In Mpls Network

As Multiprotocol Label Switching (MPLS) is becoming a more widespread technology For providing virtual private network (VPN) services, MPLS architecture security is of increasing concern to service providers (SPs) and VPN customers. MPLS suffers from a number of security issues as soon as an attacker successfully penetrates the core. This paper provides an approach to enhance security in MPLS network by integrating a new (k,n) Threshold Secret Sharing scheme with MPLS in which shares obtained are send over multiple disjoint paths. Our approach is implemented to measure time overhead on secrets packet transmission.

Privacy Preserving Collaborative Enforcement of Firewall Policies in Virtual Private Networks

The widely deployed Virtual Private Network (VPN) technology allows roaming users to build an encrypted tunnel to a VPN server, which, henceforth, allows roaming users to access some resources as if that computer were residing on their home organization's network. Although VPN technology is very useful, it imposes security threats on the remote network because its firewall does not know what traffic is flowing inside the VPN tunnel. To address this issue, we propose VGuard, a framework that allows a policy owner and a request owner to collaboratively determine whether the request satisfies the policy without the policy owner knowing the request and the request owner knowing the policy. We first present an efficient protocol, called Xhash, for oblivious comparison, which allows two parties, where each party has a number, to compare whether they have the same number, without disclosing their numbers to each other. Then, we present the VGuard framework that uses Xhash as the basic building block. The basic idea of VGuard is to first convert a firewall policy to nonoverlapping numerical rules and then use Xhash to check whether a request matches a rule. Comparing with the Cross-Domain Cooperative Firewall (CDCF) framework, which represents the state-of-the-art, VGuard is not only more secure but also orders of magnitude more efficient. On real-life firewall policies, for processing packets, our experimental results show that VGuard is three to four orders of magnitude faster than CDCF.

Balancing Request Denial Probability and Latency in an Agent-Based VPN Architecture

Agent-based virtual private networks architecture (ABVA) refers to the environment where a third-party provider runs and administers remote access virtual private network (VPN) service for organizations that do not want to maintain their own in-house VPN servers. In this paper, we consider the problem of optimally connecting users of an organization to VPN server locations in an ABVA environment so that request denial probability and latency are balanced. A user request needs a certain bandwidth between the user and the VPN server. The VPN server may deny requests when the bandwidth is insufficient (capacity limitation). At the same time, the latency perceived by a user from its current location to a VPN server is an important consideration. We present a number of schemes regarding how VPN servers are to be selected and the number of servers to be tried so that request denial probability is minimized without unduly affecting latency. These schemes are studied on a number of different topologies. For our study, we consider Poisson and non-Poisson arrival of requests under both finite and infinite population models to understand the impact on the entire system. We found that the arrival processes have a significant and consistent impact on the request denial probability and the impact on the latency is dependent on the traffic load in the infinite model. In the finite model, arrival processes have an inconsistent impact to the request denial probability. As to the latency in the finite model, arrivals that have a squared co-efficient of variation less than one is consistently largest, followed by the Poisson case, then the case that the squared co-efficient of variation is more than one. Finally, a strength of this work is the comparison of infinite and finite models; we found that a mismatch between the infinite and the finite model is dependent both on the number of users in the system and the load.

Building cost effective lower layer VPNs: The ILEC/CLEC dilemma

Layer 2 and layer 1 Virtual Private Network (VPN) services; ranging from simple leased lines to extending private LANs across public networks, are commonplace today. With the continuously growing economic difficulties, capital meltdown, and telecommunication business turmoil, delivering those VPN services at the lowest cost or with the maximum revenue margin, while committing to Service Level Agreements (SLA), has become essential. We show that whether we tackle the optimal VPN design problem from an Incumbent Local Exchange Carrier (ILEC) standpoint or from a Competitive Local Exchange Carrier (CLEC) standpoint, we obtain contradictory rules. We show that by building Edge Disjoint VPN trees and spreading the traffic all over the network, the ILEC can achieve maximum throughput and enhanced network performance; while by concentrating all the VPN traffic over a single tree, the CLEC can minimize the cost of leased bandwidth. We then propose two simple algorithms that can help carriers and service providers leverage their networks and increase their revenue margins while meeting SLA requirements. Copyright © 2010 John Wiley & Sons, Ltd.